d46075bef9ec63e5ca53187fb26987f13b6e9995cb446ad54414e721544f33fa

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 03:48

Target

37987639cfb0fab4ba112908bf2629d8_JaffaCakes118.dll
Size

72KB
MD5

37987639cfb0fab4ba112908bf2629d8
SHA1

2997e0bc59d89247ce18b766e9f80b691cd1df4c
SHA256

d46075bef9ec63e5ca53187fb26987f13b6e9995cb446ad54414e721544f33fa
SHA512

794d8c6de67362711339be1e62d6434979281b2b3c5652f02dbaeeba9087482565c6429fee6fa7c850237fb75c86caf67dd3bbda079e185bfb7fc7c37dcb7948
SSDEEP

1536:Sjjl3nwzSuOqBubw/WgT6zMKAOK2lCWcQajhRuP:C5UOq0ukgOK2l7aFQP

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 1448	1320	rundll32.exe	30
PID 1320 wrote to memory of 1448	1320	rundll32.exe	30
PID 1320 wrote to memory of 1448	1320	rundll32.exe	30
PID 1320 wrote to memory of 1448	1320	rundll32.exe	30
PID 1320 wrote to memory of 1448	1320	rundll32.exe	30
PID 1320 wrote to memory of 1448	1320	rundll32.exe	30
PID 1320 wrote to memory of 1448	1320	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\37987639cfb0fab4ba112908bf2629d8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\37987639cfb0fab4ba112908bf2629d8_JaffaCakes118.dll,#1
  2⤵
  PID:1448